Lucene search
HistoryAug 18, 2016 - 6:59 p.m.
CVE-2016-6367
cisco
asa
software
local users
privileges
cli commands
bug
security vulnerability
cve-2016-6367
nvd
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.6 High
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
Access Complexity
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:S/C:C/I:C/A:C
0.975 High
EPSS
Percentile
100.0%
Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.
Affected configurations
Node
ciscoadaptive_security_appliance_softwareMatch7.0.1
ORciscoadaptive_security_appliance_softwareMatch7.0.1.4
ORciscoadaptive_security_appliance_softwareMatch7.0.2
ORciscoadaptive_security_appliance_softwareMatch7.0.3
ORciscoadaptive_security_appliance_softwareMatch7.0.4
ORciscoadaptive_security_appliance_softwareMatch7.0.4.2
ORciscoadaptive_security_appliance_softwareMatch7.0.5
ORciscoadaptive_security_appliance_softwareMatch7.0.5.12
ORciscoadaptive_security_appliance_softwareMatch7.0.6
ORciscoadaptive_security_appliance_softwareMatch7.0.6.4
ORciscoadaptive_security_appliance_softwareMatch7.0.6.8
ORciscoadaptive_security_appliance_softwareMatch7.0.6.18
ORciscoadaptive_security_appliance_softwareMatch7.0.6.22
ORciscoadaptive_security_appliance_softwareMatch7.0.6.26
ORciscoadaptive_security_appliance_softwareMatch7.0.6.29
ORciscoadaptive_security_appliance_softwareMatch7.0.6.32
ORciscoadaptive_security_appliance_softwareMatch7.0.7
ORciscoadaptive_security_appliance_softwareMatch7.0.7.1
ORciscoadaptive_security_appliance_softwareMatch7.0.7.4
ORciscoadaptive_security_appliance_softwareMatch7.0.7.9
ORciscoadaptive_security_appliance_softwareMatch7.0.7.12
ORciscoadaptive_security_appliance_softwareMatch7.0.8
ORciscoadaptive_security_appliance_softwareMatch7.0.8.2
ORciscoadaptive_security_appliance_softwareMatch7.0.8.8
ORciscoadaptive_security_appliance_softwareMatch7.0.8.12
ORciscoadaptive_security_appliance_softwareMatch7.0.8.13
ORciscoadaptive_security_appliance_softwareMatch7.1.2
ORciscoadaptive_security_appliance_softwareMatch7.1.2.16
ORciscoadaptive_security_appliance_softwareMatch7.1.2.20
ORciscoadaptive_security_appliance_softwareMatch7.1.2.24
ORciscoadaptive_security_appliance_softwareMatch7.1.2.28
ORciscoadaptive_security_appliance_softwareMatch7.1.2.38
ORciscoadaptive_security_appliance_softwareMatch7.1.2.42
ORciscoadaptive_security_appliance_softwareMatch7.1.2.46
ORciscoadaptive_security_appliance_softwareMatch7.1.2.49
ORciscoadaptive_security_appliance_softwareMatch7.1.2.53
ORciscoadaptive_security_appliance_softwareMatch7.1.2.61
ORciscoadaptive_security_appliance_softwareMatch7.1.2.64
ORciscoadaptive_security_appliance_softwareMatch7.1.2.72
ORciscoadaptive_security_appliance_softwareMatch7.1.2.81
ORciscoadaptive_security_appliance_softwareMatch7.2.1
ORciscoadaptive_security_appliance_softwareMatch7.2.1.9
ORciscoadaptive_security_appliance_softwareMatch7.2.1.13
ORciscoadaptive_security_appliance_softwareMatch7.2.1.19
ORciscoadaptive_security_appliance_softwareMatch7.2.1.24
ORciscoadaptive_security_appliance_softwareMatch7.2.2
ORciscoadaptive_security_appliance_softwareMatch7.2.2.6
ORciscoadaptive_security_appliance_softwareMatch7.2.2.10
ORciscoadaptive_security_appliance_softwareMatch7.2.2.14
ORciscoadaptive_security_appliance_softwareMatch7.2.2.18
ORciscoadaptive_security_appliance_softwareMatch7.2.2.19
ORciscoadaptive_security_appliance_softwareMatch7.2.2.22
ORciscoadaptive_security_appliance_softwareMatch7.2.2.34
ORciscoadaptive_security_appliance_softwareMatch7.2.3
ORciscoadaptive_security_appliance_softwareMatch7.2.3.1
ORciscoadaptive_security_appliance_softwareMatch7.2.3.12
ORciscoadaptive_security_appliance_softwareMatch7.2.3.16
ORciscoadaptive_security_appliance_softwareMatch7.2.4
ORciscoadaptive_security_appliance_softwareMatch7.2.4.6
ORciscoadaptive_security_appliance_softwareMatch7.2.4.9
ORciscoadaptive_security_appliance_softwareMatch7.2.4.18
ORciscoadaptive_security_appliance_softwareMatch7.2.4.25
ORciscoadaptive_security_appliance_softwareMatch7.2.4.27
ORciscoadaptive_security_appliance_softwareMatch7.2.4.30
ORciscoadaptive_security_appliance_softwareMatch7.2.4.33
ORciscoadaptive_security_appliance_softwareMatch7.2.5
ORciscoadaptive_security_appliance_softwareMatch7.2.5.2
ORciscoadaptive_security_appliance_softwareMatch7.2.5.4
ORciscoadaptive_security_appliance_softwareMatch7.2.5.7
ORciscoadaptive_security_appliance_softwareMatch7.2.5.8
ORciscoadaptive_security_appliance_softwareMatch7.2.5.10
ORciscoadaptive_security_appliance_softwareMatch7.2.5.12
ORciscoadaptive_security_appliance_softwareMatch7.2.5.16
ORciscoadaptive_security_appliance_softwareMatch8.0.1.2
ORciscoadaptive_security_appliance_softwareMatch8.0.2
ORciscoadaptive_security_appliance_softwareMatch8.0.2.11
ORciscoadaptive_security_appliance_softwareMatch8.0.2.15
ORciscoadaptive_security_appliance_softwareMatch8.0.3
ORciscoadaptive_security_appliance_softwareMatch8.0.3.6
ORciscoadaptive_security_appliance_softwareMatch8.0.3.12
ORciscoadaptive_security_appliance_softwareMatch8.0.3.19
ORciscoadaptive_security_appliance_softwareMatch8.0.4
ORciscoadaptive_security_appliance_softwareMatch8.0.4.3
ORciscoadaptive_security_appliance_softwareMatch8.0.4.9
ORciscoadaptive_security_appliance_softwareMatch8.0.4.16
ORciscoadaptive_security_appliance_softwareMatch8.0.4.23
ORciscoadaptive_security_appliance_softwareMatch8.0.4.25
ORciscoadaptive_security_appliance_softwareMatch8.0.4.28
ORciscoadaptive_security_appliance_softwareMatch8.0.4.31
ORciscoadaptive_security_appliance_softwareMatch8.0.4.32
ORciscoadaptive_security_appliance_softwareMatch8.0.4.33
ORciscoadaptive_security_appliance_softwareMatch8.0.5
ORciscoadaptive_security_appliance_softwareMatch8.0.5.20
ORciscoadaptive_security_appliance_softwareMatch8.0.5.23
ORciscoadaptive_security_appliance_softwareMatch8.0.5.25
ORciscoadaptive_security_appliance_softwareMatch8.0.5.27
ORciscoadaptive_security_appliance_softwareMatch8.0.5.28
ORciscoadaptive_security_appliance_softwareMatch8.0.5.31
ORciscoadaptive_security_appliance_softwareMatch8.1.0.104
ORciscoadaptive_security_appliance_softwareMatch8.1.1
ORciscoadaptive_security_appliance_softwareMatch8.1.1.6
ORciscoadaptive_security_appliance_softwareMatch8.1.2
ORciscoadaptive_security_appliance_softwareMatch8.1.2.13
ORciscoadaptive_security_appliance_softwareMatch8.1.2.15
ORciscoadaptive_security_appliance_softwareMatch8.1.2.16
ORciscoadaptive_security_appliance_softwareMatch8.1.2.19
ORciscoadaptive_security_appliance_softwareMatch8.1.2.23
ORciscoadaptive_security_appliance_softwareMatch8.1.2.24
ORciscoadaptive_security_appliance_softwareMatch8.1.2.49
ORciscoadaptive_security_appliance_softwareMatch8.1.2.50
ORciscoadaptive_security_appliance_softwareMatch8.1.2.55
ORciscoadaptive_security_appliance_softwareMatch8.1.2.56
ORciscoadaptive_security_appliance_softwareMatch8.2.0.45
ORciscoadaptive_security_appliance_softwareMatch8.2.1
ORciscoadaptive_security_appliance_softwareMatch8.2.1.11
ORciscoadaptive_security_appliance_softwareMatch8.2.2
ORciscoadaptive_security_appliance_softwareMatch8.2.2.9
ORciscoadaptive_security_appliance_softwareMatch8.2.2.10
ORciscoadaptive_security_appliance_softwareMatch8.2.2.12
ORciscoadaptive_security_appliance_softwareMatch8.2.2.16
ORciscoadaptive_security_appliance_softwareMatch8.2.2.17
ORciscoadaptive_security_appliance_softwareMatch8.2.3
ORciscoadaptive_security_appliance_softwareMatch8.2.4
ORciscoadaptive_security_appliance_softwareMatch8.2.4.1
ORciscoadaptive_security_appliance_softwareMatch8.2.4.4
ORciscoadaptive_security_appliance_softwareMatch8.2.5
ORciscoadaptive_security_appliance_softwareMatch8.2.5.13
ORciscoadaptive_security_appliance_softwareMatch8.2.5.22
ORciscoadaptive_security_appliance_softwareMatch8.2.5.26
ORciscoadaptive_security_appliance_softwareMatch8.2.5.33
ORciscoadaptive_security_appliance_softwareMatch8.2.5.40
ORciscoadaptive_security_appliance_softwareMatch8.2.5.41
ORciscoadaptive_security_appliance_softwareMatch8.2.5.46
ORciscoadaptive_security_appliance_softwareMatch8.2.5.48
ORciscoadaptive_security_appliance_softwareMatch8.2.5.50
ORciscoadaptive_security_appliance_softwareMatch8.2.5.52
ORciscoadaptive_security_appliance_softwareMatch8.2.5.55
ORciscoadaptive_security_appliance_softwareMatch8.2.5.57
ORciscoadaptive_security_appliance_softwareMatch8.3.1
ORciscoadaptive_security_appliance_softwareMatch8.3.1.1
ORciscoadaptive_security_appliance_softwareMatch8.3.1.4
ORciscoadaptive_security_appliance_softwareMatch8.3.1.6
ORciscoadaptive_security_appliance_softwareMatch8.3.2
ORciscoadaptive_security_appliance_softwareMatch8.3.2.4
ORciscoadaptive_security_appliance_softwareMatch8.3.2.13
ORciscoadaptive_security_appliance_softwareMatch8.3.2.23
ORciscoadaptive_security_appliance_softwareMatch8.3.2.25
ORciscoadaptive_security_appliance_softwareMatch8.3.2.31
ORciscoadaptive_security_appliance_softwareMatch8.3.2.33
ORciscoadaptive_security_appliance_softwareMatch8.3.2.34
ORciscoadaptive_security_appliance_softwareMatch8.3.2.37
ORciscoadaptive_security_appliance_softwareMatch8.3.2.39
ORciscoadaptive_security_appliance_softwareMatch8.3.2.40
ORciscoadaptive_security_appliance_softwareMatch8.3.2.41
ORciscoadaptive_security_appliance_softwareMatch8.3.2.44
References
blogs.cisco.com/security/shadow-brokers
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli
tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
www.securityfocus.com/bid/92520
www.securitytracker.com/id/1036636
github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip
www.exploit-db.com/exploits/40271/
Social References
More
Related
nessus
nessus
cisa_kev
cisa_kev
prion
prion
Code injection
2016-08-18 18:59:00
cisco
cisco
Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability
2016-08-17 18:45:00
attackerkb
attackerkb
CVE-2016-6367
2016-08-18 00:00:00
cvelist
cvelist
CVE-2016-6367
2016-08-18 18:00:00
openvas
openvas
zdt
zdt
Cisco ASA / PIX - 'EPICBANANA' Privilege Escalation
2016-08-19 00:00:00
nvd
nvd
CVE-2016-6367
2016-08-18 18:59:01
thn
thn
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.6 High
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
Access Complexity
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:S/C:C/I:C/A:C
0.975 High
EPSS
Percentile
100.0%
Related for CVE-2016-6367